Use of Social Media City of York Council Memorandum

For: Assistant Director – Customer Services & Digital; Head of Communications Status: Final Date Issued: 15/06/2017

Where information resulting from investigation and/or audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential. 1 INTRODUCTION & SCOPE

1.1 Social media can be a key form of communication; offering free, instant, two-way communication. This can be a powerful tool for an organisation, particularly when integrated into a wider communications strategy.

However, as it is a pervasive medium that is constantly evolving, it can be difficult to control and can present some significant risks to an organisation. It can negatively affect the council’s reputation, staff relations, productivity and integrity of data. As a changing medium, there are also potential risks that are currently unknown.

There are two distinct facets to the usage of social media at the council: internal and external usage, each with their own risks. External usage can be described as how City of York Council, as an organisation, uses social media to engage with the local community.

Internal, or personal, usage can be described as how people within the council use social media. The risks here are varied and depend on individual circumstances, but the key risks could be considered as the amount of use and inappropriate use, as well as how the council manages these issues.

1.2 The initial aim of this audit was to establish the degree to which there are adequate controls relating to the overall use of social media, in both business and personal capacities. Specifically, there was an aim to provide assurance over the extent to which the management of social media usage is consistent and appropriate, and that the monitoring arrangements are balanced, proportionate and appropriate.

However, due to developing circumstances, this was not a viable approach. The area is currently undergoing a significant overhaul, with the aim of developing a social media strategy that is coherent with a wider communications strategy.

Therefore, the aim of this exercise was to provide feedback on the proposed social media policy, and assess to what extent it addresses the risks presented by the use of social media.

1.3 The current status of this development is that a draft social media policy has been drawn up by the Communications team. This is in the process of being approved by the Council Management Team. This policy builds and improves upon the existing social media policy in a number of ways.

1.4 There is a further allocation of time for this area in the 2017/18 audit plan and this could be used to review the objectives detailed at 1.2 in relation to management of social media usage and monitoring arrangements. 2 FINDINGS

Social Media Policy

2.1 The social media policy is not currently available to staff (due to being in a draft stage), there is a plan for the Chief Executive to circulate it to all staff to raise awareness. It should also be made available on the intranet for all employees. There are currently two policy documents that are being superseded by this current draft document. This new version brings together these two separate documents into one unified policy document, and goes into further detail on the topic. For example, it provides an introduction that gives context for the use of social media, it also goes into more detail on the risks of using social media, and it is also clearer about breaches of conduct.

2.2 The policy is up to date, as it is still in draft stage. It is also quite robust in terms of remaining applicable, due to the identification of underlying principles of social media rather than specific instances. It is also clear to whom the policy applies to, and these appear to be appropriate.

2.3 The policy effectively outlines social media, and the role it plays in the wider strategic aims of communication in general. Whilst there is no explicit definition of social media, an attempt has been made to identify the principles that underpin social media, and this should be sufficient. It also serves the purpose of helping to prevent the policy from becoming outdated, as the changes in this field can be rapid. The policy also highlights the major advantages of the use of social media, as well as the some of the significant risks.

2.4 The policy gives a good degree of guidance on social media. It is important to understand the policy as secondary to other more fundamental policy documents. It mediates the use of social media, but also refers to underlying policy, for example employee code of conduct and electronic communications policy. The social media policy essentially applies relevant policy to use of social media.

2.5 Data protection concerns have been addressed in the policy, and explicitly prohibits the publication or distribution of data about individuals or organisations.

2.6 The policy adequately covers the issue of monitoring of the use social media. The policy highlights the underlying policies that mediate the monitoring of social media usage, such as the employee code of conduct and the electronic communications policy. The policy makes it clear that the council reserves the right to monitor and maintain audit trails of electronic communications, and that this includes the content on social media sites. The policy also makes the important distinction that content regarding the council, created by private accounts, could also be monitored and actions raised if deemed necessary. 2.7 The policy makes a distinction between official use of social media for business purposes, and the use of social media for personal reasons. For the former, authority to make official press releases has been identified and stated, there is an attempt to co-ordinate the release of information, and adequate consideration has been given to the release of inappropriate information.

2.8 The personal use of social media has been sufficiently addressed in the policy document. Provisions have been made to ensure that no inappropriate content is produced by council employees, and there is recourse possible if necessary. There is also thought given to the overuse of social media during work time, and this would bring it in line with any other non-productive work activity. 3 CONCLUSIONS

3.1 The policy that has been drawn up is good. It adequately mitigates the risks presented by the use of social media, and finds a good balance between robustness and applicability – it goes into the right level of detail to be useful but not easily outdated.

3.2 It makes the important distinction between personal use and business use of social media, and there are adequate guidelines for both.

3.3 At the time of writing, the latest policy document was not available to staff. There is a plan to update the intranet with this new policy, and this should be done when it is finalised. It is important that the principles of the policy are embedded in the culture of the organisation, and consideration should be given to this aim. It is important that the new policy is publicised to employees, and it may be beneficial to test how engaged employees are through an iComply follow-up once the policy has been in place for a few months.

3.4 Once there has been an opportunity for the new policy to be embedded, Veritau will carry out further work to assess the effectiveness of the new policy on day-to-day operations.